Baselines and framework templates

Not every engagement should run all 299 controls. Baselines turn the catalog into a scoped, named, reproducible audit perimeter.

Start from a template

The Templates page ships ready-made selections computed live from the catalog: CIS and CIS level 1, ISO 27001 Annex A.5 and A.8, NIST AC and IA families, ANSSI recommendations, NIS2 Article 21, DORA Articles 9-10, the CISA SCuBA baseline, and a level-1-only pass. Each template shows exactly how many controls it selects — the numbers are computed from the real packs, never hardcoded.

Or build your own in the editor

The baseline editor lists every control with its referential and level. Exclude what does not apply, override a level where your client's context justifies it, filter by referential (only active connectors are proposed) and search as you go. Give the baseline a name — it is mandatory, and for good reason: that name is stamped on every audit run in history and on every report, so scope is provable months later.

Global or per client

A global baseline is available for every tenant — your house methodology. A client baseline is visible only for the active tenant — the documented exceptions of one engagement. Hover the info icons next to the two options in the editor for a reminder.